SSLVPN - Negated Split Tunneling

[vinch100]

Hello,

we want to achieve a special case where our external users would use the VPN for all traffic EXCEPT some well known VoIP Gateway that we want them to access through their local breakout, IPSec VPN has the command ipv4-split-exclude but I cannot find the same feature on SSL-VPN... any idea ?

Best regards

Vincent

[Kenundrum · Accepted solution]

This is by no means an elegant solution... but theoretically would work.

You can turn on split tunneling and then make the routed addresses be all the address space except the VOIP gateway. You'll probably have to create an address with all IPs before the address, and another with all the IPs after it and put both in the tunnel portal config. I've had to do something similar with packet captures in the past and it did work.

[vinch100]

Thank you Kenundrum, that sound like a good workaround !

[neonbit]

6.2 introduced a negate feature for firewall addresses (in address groups). They work well with policies, but have never tested for SSLVPN tunnel mode. Worth giving it a try as it's alot easier to configure.